OS X Saved Application State contains some TBB website window titles
A forensic analysis of the Tor Browser Bundle (version 2.3.25-6, 64-bit) on OS X 10.8 showed that the Saved Application State files contain traces of the Tor Browser Bundle.
Resume is one of the new features in OS X 10.7 and 10.8. The feature allows applications to save their last known state when they are closed, and then return to this state when they are later reopened.
While the Tor Browser does not use this feature, it does leak information in the files which are written to the /Users/runa/Library/Saved Application State/ directory:
- /Users/runa/Library/Saved Application State/org.mozilla.torbrowser.savedState/data.data
- /Users/runa/Library/Saved Application State/org.mozilla.torbrowser.savedState/window_3.data
- /Users/runa/Library/Saved Application State/org.mozilla.torbrowser.savedState/windows.plist
The windows.plist file contains the HTML title tag of the last active tab in the Tor Browser (or currently active tab, if the browser is still open). If the last active tab was torproject.org, then the following string will be present in the file:
- Tor Project: Anonymity Online